Snippets

mTLS Setup for Postman + Burp

3 min read

mTLS Setup for Postman + Burp

Postman+Burp Guide:

This is the recommended setup and requires setting up postman to connect to burp which connects to the API.

Setup for Postman:

  • Create new Workspace
  • Find Environments tab on left.
  • Click the + button in next column (at top) to create a new Environment
  • Variable: env, Type: Default, Initial Value/Current Value: URL
  • Name your environment. Click Save.
  • Click the “No Environment” dropdown in the top right corner and change to the name you chose.
  • Click on the Settings gear icon which is in the upper right area, then choose → Proxy
  • In Proxy: Confirm that Use the System Proxy is checked. Check Add a custom Proxy Configuration: Type HTTP/HTTPS Proxy server → Suggested settings 127.0.0.1 and port 8000 (Port is at your discretion)
  • You are still in Settings, please click on Certificates.
  • Clients Certificates → Add Certificate
  • Click CRT and use your PEM file as supplied by GS
  • Click KEY and choose your KEY file as supplied by GS.
  • Host is URL

Setup for Burp Suite:

  • Create a new project
  • Navigate to Proxy → Options → Proxy Listeners Click Add Choose Bind Port as the same port you setup in Postman (in this case 8000) Bind to Address is either 127.0.0.1 or Loopback only (both work) The rest is left as default, but you should see Certificate: per-host and TLS Protocols: Default once you create the listener.
  • Navigate to Proxy → Intercept and turn off Intercept
  • Click Open Browser to open Burp’s browser
  • Navigate to URL
  • If your setup is correct, you should see traffic

Burp Only

This section is only required if you face errors when loading the certs to Burp. If the .key and .pem files provided do not have a password, Burp will not allow them to be installed. Therefore, you must use a tool to add a password.

The following is an example of how to add a password to a certificate using OpenSSL: Openssl pkcs12 –export –out certname.p12 –inkey “client_private.key” –in “Certificate.pem”

  • “certname.p12” is a variable that can be chosen by the person running the command.
  • client_private.key and certificate.pem are files provided by the client

Setup for Burp Suite:

  • Create a new project
  • In burp, User Options → TLS → Client TLS Certificates - Import both PKCS12 keys and enable them. You may choose host * or host api.test.TARGET.com
  • Navigate to Proxy. Turn off Intercept
  • Click Open Browser to open Burp’s browser
  • Navigate to TARGET_URL
  • If your setup is correct, you should see traffic

Postman Only

  • Create new Workspace
  • Find Environments tab on left.
  • Click the + button in next column (at top) to create a new Environment
  • Variable: env, Type: Default, Initial Value/Current Value: TARGET
  • Name your environment. Click Save.
  • Click the “No Environment” dropdown in the top right corner and change to the name you chose.
  • Click the + button (closest to Overview and next to the three dots …): This creates a new ‘untitled request’
  • Optionally: Name your request
  • Leave GET as-is, and enter the request URL: TARGET
  • If everything is setup properly, clicking Send will result in TRAFFFIC

Graph View